PT-2020-14126 · Avast · Avast Antivirus

Name of the Vulnerable Software and Affected Versions: Avast Antivirus version 20.1.5069.562 Description: A security issue was found in the Login Password feature of the Password Manager component. When a user logs out or performs a Lock Vault operation, the entered password remains stored in...

PT-2020-10876 · Twitter · Bootstrap-Select

Name of the Vulnerable Software and Affected Versions: bootstrap-select versions prior to 1.13.6 Description: The issue allows Cross-Site Scripting XSS due to the failure to escape title values in OPTION elements. This may enable attackers to execute arbitrary JavaScript in a victim's browser...

ansible: dnf module install packages with no GPG signature

A flaw was found in the Ansible Engine when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code...

CVE-2020-24557

A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first...

CVE-2020-24557

A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first...

PT-2020-15593 · Sourcecodester · Sourcecodester Tailor Management

Name of the Vulnerable Software and Affected Versions: SourceCodester Tailor Management System version 1.0 Description: A Reflected Cross-Site Scripting XSS issue in the index.php login-portal webpage allows remote attackers to harvest keys pressed by an unauthenticated victim who clicks on a...

PT-2020-19743 · Node.Js · Nodee-Utils

Name of the Vulnerable Software and Affected Versions: nodee-utils versions prior to 1.2.3 Description: The issue concerns Prototype Pollution via the deepSet function. This allows for potential manipulation of object properties, which can lead to various security issues. Recommendations: For...

PT-2020-6623 · Faad2 +4 · Faad2 +4

Name of the Vulnerable Software and Affected Versions: faad2 versions 2.10.0 and earlier Description: A heap-buffer-overflow issue exists in the sbr qmf analysis 32 function located in sbr qmf.c. This allows an attacker to cause code execution. The vulnerability is related to a buffer overflow,...

PT-2020-5503 · Mpxj · Mpxj

Name of the Vulnerable Software and Affected Versions: MPXJ versions 8.1.3 and earlier Description: The issue is related to the incorrect restriction of XML external entity references in the GanttProjectReader and PhoenixReader components of the MPXJ library. This can allow a remote attacker to...

PT-2020-15817 · Wso2 · Wso2 Identity Server Analytics +5

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions through 3.1.0 WSO2 API Manager Analytics version 2.5.0 WSO2 IS as Key Manager versions through 5.10.0 WSO2 Identity Server versions through 5.10.0 WSO2 Identity Server Analytics versions through 5.6.0 WSO2 IoT Server...

PT-2021-11934 · Symonics +2 · Libmysofa +2

Name of the Vulnerable Software and Affected Versions: Symonics libmysofa versions 0.5 through 1.1 Description: The issue allows attackers to execute arbitrary code via a crafted SOFA file, due to a buffer overflow in the readDataVar function in hdf/dataobject.c. Recommendations: For versions 0.5...

PT-2020-13860 · Codiad · Codiad

Name of the Vulnerable Software and Affected Versions: Codiad versions 1.7.8 and later Description: A Cross Site Scripting XSS issue was found due to improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. The vendor states that Codiad is no long...

CVE-2020-20634

Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog...

PT-2020-15277 · Elementor · Elementor

Name of the Vulnerable Software and Affected Versions: Elementor versions 2.9.5 and below Description: The issue allows authenticated users to activate the safe mode feature, which can be exploited to disable all security plugins on the blog. Recommendations: For versions 2.9.5 and below, update ...

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

...

UBUNTU-CVE-2020-12403

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length...

PT-2020-19726 · Nis-Utils · Nis-Utils

Name of the Vulnerable Software and Affected Versions: nis-utils versions up to and including 0.6.10 Description: The issue concerns Prototype Pollution via the setValue function. This affects all versions of the package up to and including 0.6.10. Recommendations: For versions up to and includin...

PT-2020-6622 · Faad2 +4 · Faad2 +4

Name of the Vulnerable Software and Affected Versions: faad2 versions through 2.10.0 Description: An issue exists in the function ftypin located in mp4read.c, which allows for a stack-buffer-overflow. This enables an attacker to cause code execution. The vulnerability is related to a buffer...

OPENSUSE-SU-2020:1215-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 boo1175085 CVE-2020-6542: Use after free in ANGLE CVE-2020-6543: Use after free in task scheduling CVE-2020-6544: Use after free in media CVE-2020-6545: Use after free in audio CVE-2020-6546: Inappropriate...

OPENSUSE-SU-2020:1214-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 boo1175085 CVE-2020-6542: Use after free in ANGLE CVE-2020-6543: Use after free in task scheduling CVE-2020-6544: Use after free in media CVE-2020-6545: Use after free in audio CVE-2020-6546: Inappropriate...